Legacy scanners are already too slow for today's exploits

Executive summary: The Cogent Q2 2026 Detection Gap analysis — summarized in this report and used to support runZero’s product positioning — finds that legacy signature-based vulnerability scanners fail to protect against most critical vulnerabilities: 55.7% of critical CVEs never received signatures, 62% of those that did had exploits circulating before signatures shipped, and overall 83.2% lacked timely coverage. The report attributes the shrinking time-to-exploit to AI-assisted exploit development, highlights a median signature publication lag of 2.7 days, and recommends moving from reactive CVE scanning to continuous asset-inventory and exposure-driven defenses.